Skills

offensive-business-logic

offensive-business-logic is a skill in SnailSploit/Claude-Red, last changed 6 May 2026. It can run shell commands, reach the network and name web addresses — read the findings before installing. Our pattern check flagged nothing at commit a8de813 on 27 Oct 2026.

Pattern check: nothing flagged · commit a8de813 · 27 Oct 2026

Install
From the author
Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.
Licence
MIT
Repo stars
9.6k
Folder last changed
6 May 2026 (opens in a new tab)
Publisher
SnailSploit
Files
1 file
Checked
a8de813 (opens in a new tab) · 27 Oct 2026

Install

Each tab says whether it installs commit a8de813, the one we checked, or the latest version.

No tab for your agent? Use Any agent for OpenCode, Goose, Windsurf (Devin Desktop), Zed, Roo Code, Factory Droid, Junie, Amp and Antigravity, and Claude Code for Cline. Kiro needs the folder copied by hand.

Pinned to commit a8de813, the one we checked.

From your project's root folder:

tmp="$(mktemp -d)" &&
  git clone -q --depth 1 --filter=blob:none --no-checkout https://github.com/SnailSploit/Claude-Red.git "$tmp" &&
  git -C "$tmp" fetch -q --depth 1 origin a8de813edc9f66f60d44cfe42d47750e89d9930b &&
  git -C "$tmp" sparse-checkout set -- Skills/web/offensive-business-logic &&
  git -C "$tmp" checkout -q a8de813edc9f66f60d44cfe42d47750e89d9930b &&
  mkdir -p .claude/skills &&
  mkdir .claude/skills/offensive-business-logic &&
  cp -R "$tmp"/Skills/web/offensive-business-logic/. .claude/skills/offensive-business-logic/ &&
  rm -rf "$tmp"

If Claude Code was already running and this created the skills folder, run /reload-skills.

Claude Code docs (opens in a new tab)

What it can touch

From the files and frontmatter at commit a8de813. This is how much a skill can do, not whether it is risky.

What it can touch: Shell, network or credentials

  • Runs shell commands

    Its instructions or files give the agent commands to run on your computer.

  • Reaches the network

    It sends or fetches data over the internet, for example with curl, an HTTP library or a package install.

  • Names web addresses

    It mentions outside web addresses the agent may visit. We list them but don't follow them.

Pattern check

Pattern check: nothing flagged · commit a8de813 · 27 Oct 2026

We checked every text file in this skill, at commit a8de813 on 27 Oct 2026, against 45 published patterns such as download-and-run commands, hidden text and credential access. We don't run the skill, we don't read the web pages it points to, and we can't judge everything its instructions might lead an agent to do. In published tests, pattern checks like this one missed most malicious skills. Read the skill before you install it — especially anything it asks you to download or run.

How the check worksReport an incorrect finding

Outside links we did not follow

  • https://app/main.js
  • https://app/api/openapi.json
  • https://app$path
  • https://github.com/SnailSploit/offensive-checklist/blob/main/business-logic.md

Format check

Each agent reads SKILL.md a little differently. We check the file against each one's published rules; we don't run the skill in any agent.

  • Agent Skills specPasses

    The open format from agentskills.io, held to what the strictest agents enforce, so one folder loads everywhere.

    • Note

      There is no license field, so readers can't tell whether they may reuse the skill. O2

      Fix: Add license: with an SPDX name such as MIT or Apache-2.0, or the name of a bundled licence file.

  • Claude CodePasses
  • Claude apps & API uploadPasses

    Uploading to claude.ai or the Claude API, or packaging with Anthropic's script, accepts only the six spec fields and stops on anything else.

    • Note

      The description is 664 characters. The claude.ai Help Center says 200 at most, though Anthropic's API docs and validator allow 1,024. D4

      Fix: If the claude.ai upload refuses it, trim the description to 200 characters.

  • OpenAI (Codex & API)Passes
  • VS Code & CopilotPasses

SKILL.md

Files

1 file

PathSize
SKILL.md (opens in a new tab)13 KB

More from SnailSploit/Claude-Red

  • offensive-active-directory

    SnailSploit/Claude-Red

    Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.

    • Touches credentials
    • Runs shell commands
    • +1 more
    Pattern check: Nothing flagged

    MIT · 9.6k repo stars · Updated 6 May 2026

  • offensive-advanced-redteam

    SnailSploit/Claude-Red

    Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.

    • Touches credentials
    • Downloads software
    • +3 more
    Pattern check: 1 item to review

    MIT · 9.6k repo stars · Updated 25 Aug 2026

  • offensive-ai-security

    SnailSploit/Claude-Red

    • Names web addresses
    Pattern check: 2 items to review

    MIT · 9.6k repo stars · Updated 6 May 2026

  • offensive-anti-forensics

    SnailSploit/Claude-Red

    Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the destruction or manipulation method, and the defender perspective so operators understand detection gaps they must account for.

    • Touches credentials
    • Runs shell commands
    • +2 more
    Pattern check: Nothing flagged

    MIT · 9.6k repo stars · Updated 25 Aug 2026

  • offensive-api-abuse

    SnailSploit/Claude-Red

    Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authorized penetration testers targeting business logic layers that automated scanners miss.

    • Touches credentials
    • Runs shell commands
    • +2 more
    Pattern check: Nothing flagged

    MIT · 9.6k repo stars · Updated 25 Aug 2026

  • offensive-api-security

    SnailSploit/Claude-Red

    Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.

    • Touches credentials
    • Runs shell commands
    • +2 more
    Pattern check: Nothing flagged

    MIT · 9.6k repo stars · Updated 25 Aug 2026

All skills in SnailSploit/Claude-Red